[dispatch] Re: Proposal for New Work: OODA-HTTP — Adaptive Security Framework for HTTP/HTTPS

[Ted Hardie <[e-mail]>]

Hi Rachid,

Without comment on the broader proposal, may I draw your attention to RFC
6648: https://datatracker.ietf.org/doc/html/rfc6648.  This is a BCP
recommending against the use of X- headers and similar constructs.
Whatever the dispatch outcome, I suggest you consider its advice in updates
to your design.

best regards,

Ted Hardie

On Thu, Jul 3, 2025 at 2:45 AM Rachid Bouziane <[e-mail]> wrote:

> Thanks a lot for your question.
>
> DOTS focuses on signaling volumetric DDoS attacks to a mitigation
> server, typically via a dedicated control channel.
> OODA-HTTP, in contrast, introduces a behavioral layer directly inside
> HTTP/HTTPS to allow each HTTP request to carry lightweight telemetry
> (via the X-OODA-Action header), enabling real-time context-aware
> response at the edge (block, challenge, rotate TLS keys, etc.).
>
> It's more about individual behavioral defense (e.g. against bots,
> anomalous clients) than large-scale DDoS signaling.
> We see it as complementary to DOTS, acting inside the HTTP/TLS runtime,
> not outside.
>
> Happy to elaborate further if helpful.
>
> Best regards,
> Rachid Bouziane
> SecRoot.io — OODA-HTTP Initiative
>
> _______________________________________________
> dispatch mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>